blog.netlab.360.comThird-party advisoryTechnical description
https://blog.netlab.360.com/multiple-botnets-are-spreading-using-lilin-dvr-0-day CVE-2025-34130
HIGH
LILIN DVR Arbitrary File Read via net_html.cgi
Record summary
CVE-2025-34130 has a selected CVSS score of 8.7 (high).
Description
An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to facilitate further attacks including command injection. The vulnerability has been exploited in the wild in conjunction with other issues by botnets like FBot and Moobot.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Mar 20, 2020 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 17, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Digital Video Recorder (DVR)Browse LILIN / Digital Video Recorder (DVR) | VulnCheck | Version data not supplied | |
DVR FirmwareBrowse Merit LILIN / DVR FirmwareDefault status: unaffected | CVE List | Before 2.0b60_20200207 | affected |
References
4nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-34130 meritlilin.comVendor advisorypatch
https://www.meritlilin.com/assets/uploads/support/file/M00158-TW.pdf vulncheck.comThird-party advisory
https://www.vulncheck.com/advisories/lilin-dvr-multiple-vulnerabilities